FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8lossydecodealpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width height to disclose stale pixel data from previously decoded frames.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in takdecodeframe() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio.

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit() does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcmencodeframe() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCMMS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process.

FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with Intel Quick Sync encoders without rescaling, to crash the application or corrupt heap memory.

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstreamindex triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.

FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsvdecodeblock() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output.

FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqadecodeframe() to render frames from leftover heap bytes visible in decoded output.

FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaptiontransasssubtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using regioncount instead of numrects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap.

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing cookdecodeframe() to write decoded samples beyond allocated output planes in any application decoding the file.

FFmpeg through 9.0.2 contains an integer overflow in cbsjpegwritescan() in libavcodec/cbsjpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filterunits, to corrupt the heap or crash the application.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in dngdecodetiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INTMAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ffjpeglsdecodepicture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.

FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ffmjpegdecodesof() to pass a stale rawimagebuffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in ffproreskostyaencodeinit() that miscalculates framesizeupperbound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the proresks encoder, causing encodeframe() to write slices past an undersized packet buffer and corrupt heap memory.

FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.

Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser.

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vdpauhevcstartframe() in libavcodec/vdpauhevc.c that copies unbounded PPS tile counts into fixed-size VDPAU arrays. Attackers can supply crafted HEVC bitstreams with excessive tile columns or rows to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications using VDPAU decoding.

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ffdxva2hevcfillpictureparameters() that allows attackers to corrupt memory via unbounded non-uniform tile counts. Attackers can supply crafted HEVC bitstreams with many non-uniformly spaced tiles to write controlled 16-bit values past fixed-size DXVA arrays during DXVA2, D3D11VA, or D3D12VA decoding on Windows.

FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gifimagewriteimage() in libavcodec/gif.c because shrunkbuf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remapframetopalette() to write past shrunkbuf and corrupt the heap during GIF transcoding.

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parseframeheader() in libavcodec/jpegxlparser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toccount, making the parser loop excessively and exhaust CPU.

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl() fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale(), crashing the decoding process.

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ffllvidencdiffbytesrvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2() allocations and exhaust memory.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwttmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ffnvdecstartframe() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before endframe, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.

FFmpeg through 9.0.2 contains a division by zero vulnerability in doviconfigureext() in libavcodec/dovirpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovirpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.

FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in getexponentdynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPTSIZE and overwrite adjacent heap memory.

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in oldcodec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.